WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3166-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.1.3. It is, therefore, affected by a remote code execution vulnerability in WebKit due to a memory corruption issue. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website, to cause a denial of service condition or execution of arbitrary code.

The version of iOS running on the mobile device is prior to 9.3.5. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     kernel due to improper sanitization of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to run a specially crafted     application, to disclose sensitive information from     kernel memory. (CVE-2016-4655)

  - A remote code execution vulnerability exists in the     kernel due to a memory corruption issue. An     unauthenticated, remote attacker can exploit this by     convincing a user to run a specially crafted     application, to cause a denial of service condition or     execution of arbitrary code. (CVE-2016-4656)

  - A remote code execution vulnerability exists in WebKit     due to a memory corruption issue. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a malicious website, to cause a denial of     service condition or execution of arbitrary code.
    (CVE-2016-4657)

These three zero day vulnerabilities were disclosed on 2016/08/25 and are known to be used by the NSO Group's spyware product Pegasus.

ID	Name	Product	Family	Severity
96406	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3166-1)	Nessus	Ubuntu Local Security Checks	critical
93593	Mac OS X : Apple Safari < 9.1.3 WebKit Memory Corruption RCE	Nessus	MacOS X Local Security Checks	high
93124	Apple iOS < 9.3.5 Multiple Vulnerabilities (Trident)	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2016-4657

high

Tenable Plugins

critical

high

high